Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://albertoforero.com/
Detected Brand
Unknown
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
afb8c916-e76…
Analyzed
2026-06-16 23:35
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T154F341F710C4A7399B86C3C56962B73CD28301DBADD18DCED1D29E46ED4DBE2A91018E |
|
CONTENT
ssdeep
|
1536:MR2SEwgPRpHhyHgYPN6sPycQPB1PqiPP5H87PyRnNfY03pNSYQ/0jmSOf1xzeygi:MkSfCd3MXEKJSW6Y9 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8c7e33cc7383843 |
|
VISUAL
aHash
|
ffff09be9e8e8e6e |
|
VISUAL
dHash
|
0dcf1b74343c34c8 |
|
VISUAL
wHash
|
e7ff083e1e060e2a |
|
VISUAL
colorHash
|
07210000006 |
|
VISUAL
cropResistant
|
0dcf1b74343c34c8,bc0c5e1f3b3b23b5 |
Code Analysis
Risk Score
79/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://jackpot86-login.id/
- https://mirandamckeon.com/blog/thebuzzofvibrancyintheair
- https://www.howtoblog.org/best-blogging-platforms
- https://honeyandsageco.com/collections/
- https://baji999-login.org/
- https://lahanaswim.com/account/login
- https://www.vectalys.com/blog/what-are-the-differences-between-transfection-and-transduction-222/
- https://thehomeofficelife.com/blog/working-from-home-tax-relief-changes
- https://smokinjs.com/collections/dab-straws
- https://movalog.com/word-cookies-answers/
- https://www.ledtonic.com/account/login
- https://www.humanizandolagestionsanitaria.com/blog/
- https://hanamipsicologia.es
- https://crickex-login.org/
- https://snesology.net/
- https://www.iisuniv.ac.in/blog
- http://aworkoutlog.com/
- https://www.altrobologna.com/menu
- https://blog.apkmodest.com/
- https://blog.divercity.io/
- https://www.lowhertzcaraudio.com/collections/amplifiers
- https://procolored.eu/fr/collections/imprimante-pour-t-shirt
- https://www.wealthandpower.org/blog/
- https://oncologyresearch2024.com/
- https://intellix-capitalone-login.cc/
- https://www.hustletraining.com/blog
- https://www.procolored.com/collections/dtf-printer
- https://marvelbet-login.org/
- https://mymsdlogin.com/
- https://heylink.me/alohatotologin/
- https://souchi.com/collections/souchi
- https://kilclothes.com/collections/all/
- https://www.myautonomie.com/blog/
- https://dewatogel5d.blogspot.com/
- https://admin.onebidasset.com/
- https://jostip.org/login/
- https://www.overcommitted.com/work/mileagelog/
- https://albertoforero.com/technology-shaping-the-present-and-building-the-future-2/
- http://sportingbounce.com/blog
- https://dramaqu.blog/
- https://www.lisamt2.com/blog-14.htm
- https://www.e-psychologist.org/
- https://tmtblogs.com/
- https://wott.io/blog
- https://reflexology.place/
- https://heylink.me/klik88_login/
- https://immortalliumblog.com/the-unusual-genre-of-harem/
- https://sdyresult.com/
- https://logicalnetworksolution.com/
- https://api55.blog/
- https://theprologuespodcast.com/
- https://lechapeaumagique.com/collections/boucles-doreilles-clips
- https://thesimplymeblog.com/
- https://www.k86sport-login.com/
- https://www.arylic.com/collections/diy-audio
- https://www.dewa33login.com/
- https://winbuzz-login.app/
- https://www.ringsizechart.net/ring-size-chart-blogs/
- https://cibc-digital-authlog.com
- https://albertoforero.com/category/technology/
- https://baby-sales.nl/collections/pampers-baby-dry
- https://91club-login.net/
- https://www.ledtonic.com/blogs/grow-marijuana/grow-weed-indoors-guide-for-beginners-to-cultivate-cannabis
- https://assignment-helpers.com/blog/
- https://dafabet-login.info/
- https://blog.histaff.io/
- https://interphexblog.com/
📡 API Calls Detected
- POST
📤 Form Action Targets
- https://albertoforero.com/
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
Credential Harvesting
Credential harvesting detected with 4 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 939 technique(s) to evade detection
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
HIGH - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 939 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Generic Phishing
Official Website
N/A
Fake Service
Banking/payment service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 939 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
albertoforero.com
Registered
2022-06-14 11:52:12+00:00
Registrar
NAMECHEAP INC
Status
Active (older domain)
Hosting Information
Provider
Namecheap
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.